inventory-management-system EUVD-2026-77039

The application must be deployed and reachable over a network (typically HTTP/HTTPS). The vulnerable endpoint is dashboard.php, which must be accessible without prior authentication - or must accept the userid parameter before enforcing session ownership checks. The CVSS 4.0 vector assigns PR:N, indicating no authenticated session is required to trigger the flaw. The limiting factors are: (1) the software must actually be deployed and internet-accessible, as it is a niche open-source project; (2) the confidentiality impact is Low, suggesting only partial or indirect data disclosure rather than full system compromise; (3) no integrity or availability impact is indicated, limiting the attack to read-only unauthorized access. There are no platform-specific requirements beyond a PHP-capable web server hosting this application.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) with E:P (exploit proof-of-concept) reflects a remotely reachable, low-complexity attack requiring no privileges and no user interaction. The confidentiality impact is rated Low (VC:L) with no integrity or availability impact, yielding a score of 5.5 - moderate in absolute terms. EPSS data is not provided, but a public exploit in a GitHub issue against a small, unmaintained project makes this a realistic opportunistic target for anyone scanning for exposed dashboards. The absence of a CISA KEV listing and the Low confidentiality impact bound the real-world severity: this is not a system-compromise vector but rather an unauthorized data disclosure risk. The product appears to be a niche open-source project with limited enterprise adoption, which constrains blast radius significantly. The maintainer's non-response to disclosure is a meaningful risk amplifier for anyone currently running this software, as no patch path exists.

An attacker discovers a publicly accessible installation of the inventory-management-system via web search or automated scanning and navigates to dashboard.php. By iterating or guessing userid values in the URL or POST parameters - aided by the published proof-of-concept in GitHub issue #15 - the attacker retrieves inventory or user data belonging to other accounts without authenticating as those users. The low attack complexity and available PoC make this trivially repeatable against any exposed instance.